Software update device, vehicle, and software update method

ABSTRACT

A software update device is provided with an update control unit that performs a software update using a new software version supplied over a network. The update control unit installs a first new software version on a first electronic control device prior to installing a second new software version on a second electronic control device, and activates the first new software version installed on the first electronic control device either after activation of the second new software version installed on the second electronic control device has started or after it is ascertained that activation of the second new software version installed on the second electronic control device has been normally completed.

TECHNICAL FIELD

The present invention relates to a software updating apparatus (softwareupdate device), a vehicle, and a software updating method (softwareupdate method).

BACKGROUND ART

JP 2018-045515 A discloses technology for updating software of a controlapparatus using updating software distributed from a server.

SUMMARY OF INVENTION

However, there is a desire for technology capable of more favorablyperforming the update of the software.

It is an objective of the present invention to provide a softwareupdating apparatus, a vehicle, and a software updating method that arecapable of more favorably performing the update of the software.

A software updating apparatus according to an aspect of the presentinvention includes an acquiring section configured to acquirenew-version software supplied via a network; and an update controlsection configured to perform a software update for each of a pluralityof electronic control units mounted in a vehicle, using the new-versionsoftware acquired by the acquiring section, wherein a first electroniccontrol unit among the plurality of electronic control units includes astorage-capable region in which first new-version software, for updatingfirst old-version software installed in the first electronic controlunit, is allowed to be installed in a background, and wherein the updatecontrol section performs installation of the first new-version softwarein the storage-capable region of the first electronic control unit inthe background before installation of second new-version software in asecond electronic control unit among the plurality of electronic controlunits, and after activation of the second new-version software installedin the second electronic control unit is started or after it is foundthat the activation of the second new-version software installed in thesecond electronic control unit will be completed normally, the updatecontrol section activates the first new-version software installed inthe storage-capable region of the first electronic control unit.

A software updating apparatus according to another aspect of the presentinvention includes an acquiring section configured to acquirenew-version software supplied via a network, and an update controlsection configured to perform a software update for each of a pluralityof electronic control units included in a vehicle, using the new-versionsoftware acquired by the acquiring section, wherein a first electroniccontrol unit among the plurality of electronic control units includes astorage-capable region in which first new-version software, for updatingfirst old-version software installed in the first electronic controlunit, is allowed to be installed in a background, wherein a secondelectronic control unit among the plurality of electronic control unitsdoes not include a storage-capable region in which second new-versionsoftware, for updating second old-version software installed in thesecond electronic control unit, is allowed to be installed in thebackground, and wherein when a main power source of the vehicle is ON,the update control section performs installation of the firstnew-version software in the storage-capable region of the firstelectronic control unit in the background, and then, when theinstallation of the first new-version software in the storage-capableregion of the first electronic control unit has been completed and themain power source of the vehicle is turned OFF, the update controlsection performs installation of the second new-version software in thesecond electronic control unit, and then, after the installation of thesecond new-version software in the second electronic control unit hasbeen completed, the update control section activates the firstnew-version software installed in the storage-capable region of thefirst electronic control unit and the second new-version softwareinstalled in the second electronic control unit.

A vehicle according to still another aspect of the present inventionincludes the software updating apparatus described above.

A software updating method according to still another aspect of thepresent invention, for performing a software update for each of aplurality of electronic control units included in a vehicle, by usingnew-version software supplied via a network, wherein a first electroniccontrol unit among the plurality of electronic control units includes astorage-capable region in which first new-version software, for updatingfirst old-version software installed in the first electronic controlunit, is allowed to be installed in a background, the method includes astep of installing the first new-version software in the storage-capableregion of the first electronic control unit in the background, a step ofinstalling, when the installation of the first new-version software inthe storage-capable region of the first electronic control unit has beencompleted and a main power source of the vehicle is turned OFF, secondnew-version software in a second electronic control unit among theplurality of electronic control units, and a step of activating, afteractivation of the second new-version software installed in the secondelectronic control unit is started or after it is found that theactivation of the second new-version software installed in the secondelectronic control unit will be completed normally, the firstnew-version software installed in the storage-capable region of thefirst electronic control unit.

According to the present invention, it is possible to provide a softwareupdating apparatus, a vehicle, and a software updating method that arecapable of more favorably performing the update of the software.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a block diagram showing a software updating system including asoftware updating apparatus according to an embodiment;

FIGS. 2A and 2B schematically show an example of a configuration of anonvolatile memory;

FIG. 3 is a timing chart showing an example of an operation of thesoftware updating apparatus according to the embodiment;

FIG. 4 is a flowchart showing an example of an operation of the softwareupdating apparatus according to the embodiment;

FIG. 5 is a flowchart showing an example of an operation of the softwareupdating apparatus according to the embodiment;

FIG. 6 is a flowchart showing an example of an operation of the softwareupdating apparatus according to the embodiment;

FIG. 7 is a flowchart showing an example of an operation of the softwareupdating apparatus according to the embodiment;

FIG. 8 is a flowchart showing an example of an operation of the softwareupdating apparatus according to the embodiment;

FIG. 9 is a flowchart showing an example of an operation of the softwareupdating apparatus according to the embodiment;

FIG. 10 is a flowchart showing an example of an operation of thesoftware updating apparatus according to the embodiment; and

FIG. 11 is a flowchart showing an example of an operation of thesoftware updating apparatus according to the embodiment.

DESCRIPTION OF EMBODIMENTS

The following describes in detail preferred embodiments of a softwareupdating apparatus, a vehicle, and a software updating method accordingto the present invention, while referencing the accompanying drawings.

Embodiment

A software updating apparatus, a vehicle, and a software updating methodaccording to one embodiment will be described with reference to thedrawings. FIG. 1 is a block diagram illustrating a software updatingsystem including a software updating apparatus according to the presentembodiment.

A software updating system 11 according to the present embodimentincludes a vehicle 10 and a server (external device) 22.

The vehicle 10 includes a software updating apparatus 12, acommunicating section 14, electronic control units (ECUs) 16, anignition switch (IGSW) 18, a battery (BAT) 20, and a display section 21.The reference numeral 16 is used when describing an electronic controlunit in general, and the reference numerals 16A and 16B are used whendescribing individual electronic control units. The vehicle 10 includesa large number of electronic control units 16, and FIG. 1 illustratestwo of the large number of electronic control units 16. That is, FIG. 1illustrates a first electronic control unit 16A and a second electroniccontrol unit 16B among the large number of electronic control units 16.Here, an example is described of a case in which the first electroniccontrol unit 16A and the second electronic control unit 16B operatecooperatively (operate in synchronization). The vehicle 10 also includesconfigurational elements other than the configurational elementsmentioned above, but descriptions thereof are omitted here.

The server 22 includes a database 38 and a communicating section 40. Thecommunicating section 40 can perform wireless communication with thecommunicating section 14 included in the vehicle 10. New-versionsoftware (update software) for updating the software (old-versionsoftware or current software) installed in the electronic control units16 can be stored in the database 38. The server 22 also includesconfigurational elements other than the configurational elementsmentioned above, but descriptions thereof are omitted here.

The communicating section 14 can perform wireless communication with thecommunicating section 40 included in the server 22, via a network 25.The network 25 is the Internet, for example, but is not limited to this.The communicating section 14 may be a communicating section that canperform cellular communication, or may be a communicating section thatcan perform wireless LAN communication. The communicating section 14 canreceive the new-version software supplied from the server 22 via thenetwork 25.

The software updating apparatus 12 includes a computing section 24 and astorage section 26. The computing section 24 performs overall control ofthe software updating apparatus 12. The computing section 24 is formedby a CPU (Central Processing Unit), for example. The computing section24 performs update control of the software (firmware) by controllingeach section based on a program stored in the storage section 26. Thestorage section 26 includes a volatile memory (not shown in thedrawings) and a nonvolatile memory (not shown in the drawings). Thenew-version software downloaded from the server 22 can be temporarilystored in the storage section 26.

The computing section 24 includes an acquiring section 28, an updatecontrol section 30, a time margin determining section 32, a power amountdetermining section 34, and a scheduled startup timing determiningsection 36. The acquiring section 28, the update control section 30, thetime margin determining section 32, the power amount determining section34, and the scheduled startup timing determining section 36 can berealized by the computing section 24 executing the program stored in thestorage section 26.

The acquiring section 28 acquires the new-version software (software)supplied from the server 22 via the network 25. More specifically, theacquiring section 28 acquires the new-version software received by thecommunicating section 14.

The update control section 30 performs an update of the software foreach of the plurality of electronic control units 16 mounted in thevehicle 10, by using the new-version software acquired by the acquiringsection 28.

Here, an example is described of a case in which first old-versionsoftware (first current software) is installed in the first electroniccontrol unit 16A. Furthermore, the example described here is a case inwhich second old-version software (second current software) is installedin the second electronic control unit 16B. The example described here isa case in which the first old-version software installed in the firstelectronic control unit 16A is updated by first new-version softwaresupplied from the server 22. Furthermore, the example described here isa case in which the second old-version software installed in the secondelectronic control unit 16B is updated by second new-version softwaresupplied from the server 22.

The storage capacity of the nonvolatile memory (not shown in thedrawings) included in the first electronic control unit 16A isrelatively high. FIG. 2A schematically illustrates an example of aconfiguration of the nonvolatile memory included in the first electroniccontrol unit 16A. The first electronic control unit 16A includes aplurality of nonvolatile memory chips. Here, an example is described ofa case in which two nonvolatile memory chips are included. That is, inthis example, a case where a first memory chip and a second memory chipare provided will be described. The first memory chip is mounted on onesurface of a substrate (not shown in the drawings), for example. Thesecond memory chip is mounted on the other surface of the substrate, forexample. The first memory chip forms a first bank (first memory bank orfirst storage location) 50A. The second memory chip forms a second bank(second memory bank or second storage location) 50B. Such aconfiguration is referred to as a double bank. In the first electroniccontrol unit 16A, in a state where the first old-version software isinstalled in the first bank 50A, for example, it is possible to installthe first new-version software in the second bank 50B. That is, thesecond bank 50B can function as a buffer when installing the firstnew-version software. In other words, the second bank 50B can functionas a storage-capable region (installation-capable region) in which thefirst new-version software can be installed in the background. Here, anexample is described of a case in which the first electronic controlunit 16A includes a plurality of memory chips, but the present inventionis not limited to this. The first electronic control unit 16A mayinstead include a single high-capacity memory chip. The first bank 50Aand the second bank 50B may be included in the single high-capacitymemory chip.

The first electronic control unit 16A is an electronic control unithaving a display control function, for example, but is not limited tothis. More specifically, the first electronic control unit 16A is an ECUfor in-vehicle infotainment (IVI), an ECU for a meter display section,or the like, for example, but is not limited to this.

The capacity of the nonvolatile memory (not shown in the drawings)included in the second electronic control unit 16B is relatively low.FIG. 2B schematically illustrates an example of a configuration of thenonvolatile memory included in the second electronic control unit 16B.The second electronic control unit 16B includes only one nonvolatilememory chip, for example. A bank 52 is formed by the one memory chip.The second electronic control unit 16B includes only one bank 52. Such aconfiguration is referred to as a single bank. In the second electroniccontrol unit 16B, in a state where the second old-version software isinstalled in the memory chip, it is not possible to install the secondnew-version software in this memory chip. In this way, the secondelectronic control unit 16B does not include a storage-capable region inwhich the second new-version software can be installed in thebackground.

As described above, the first electronic control unit 16A includes astorage-capable region in which the first new-version software can beinstalled in the background. In other words, the first electroniccontrol unit 16A includes the second bank 50B in which the firstnew-version software can be installed in the background. Therefore, thefirst new-version software can be installed in the first electroniccontrol unit 16A while the vehicle 10 is travelling.

As described above, the second electronic control unit 16B does notinclude a storage-capable region in which the second new-versionsoftware can be installed in the background. Therefore, the secondnew-version software cannot be installed in the second electroniccontrol unit 16B while the vehicle 10 is travelling. Accordingly, theupdate control section 30 performs the installation of the secondnew-version software in the second electronic control unit 16B when thevehicle 10 is stopped. In other words, the update control section 30installs the second new-version software in the second electroniccontrol unit 16B when the main power source of the vehicle 10 is OFF.That is, the update control section 30 installs the second new-versionsoftware in the second electronic control unit 16B when the ignitionswitch 18 is OFF. Even when the ignition switch 18 is OFF, the power canbe suitably supplied to the software updating apparatus 12, thecommunicating section 14, the electronic control units 16, and the likefrom the battery 20 and the like.

As described above, the first new-version software can be installed inthe first electronic control unit 16A even while the vehicle 10 istravelling. From the viewpoint of shortening the time during which theuser cannot use the vehicle 10, the following process is preferablyperformed for the first electronic control unit 16A in which the firstnew-version software can be installed while the vehicle 10 istravelling. Specifically, the first new-version software is preferablyinstalled in the first electronic control unit 16A in advance while thevehicle 10 is travelling. Thus, in the present embodiment, the updatecontrol section 30 installs the first new-version software in the firstelectronic control unit 16A while the vehicle 10 is travelling, forexample, in the background. That is, the update control section 30installs the first new-version software in the first electronic controlunit 16A prior to installation of the second new-version software in thesecond electronic control unit 16B. As an example, the first new-versionsoftware is installed in the second bank 50B when the first old-versionsoftware is installed in the first bank 50A. The activation of the firstnew-version software installed in the first electronic control unit 16Ais not performed while the vehicle 10 is travelling. The activationmeans making it possible to perform a function provided to theelectronic control unit or the like during a first startup or after aninitialization of this electronic control unit or the like.

As described above, the installation of the second new-version softwarein the second electronic control unit 16B is performed when the vehicle10 is stopped. The update control section 30 performs a process such asdescribed below after the installation of the second new-versionsoftware in the second electronic control unit 16B has been completed.That is, the update control section 30 performs the activation of thefirst new-version software installed in the first electronic controlunit 16A and the activation of the second new-version software installedin the second electronic control unit 16B. That is, the update controlsection 30 performs the activation of the second new-version softwareinstalled in the second electronic control unit 16B, in parallel withthe activation of the first new-version software installed in the firstelectronic control unit 16A. The update control section 30 may performthe activation of the second new-version software installed in thesecond electronic control unit 16B, after the activation of the firstnew-version software installed in the first electronic control unit 16Ais completed. Otherwise, the update control section 30 may perform theactivation of the first new-version software installed in the firstelectronic control unit 16A, after the activation of the secondnew-version software installed in the second electronic control unit 16Bis completed. Incidentally, a process such as described below may bestarted at a timing at which it has been found that the activation ofthe first new-version software installed in the first electronic controlunit 16A will be completed. That is, at such a timing, the activation ofthe second new-version software installed in the second electroniccontrol unit 16B may be started. Incidentally, a process such asdescribed below may be started at a timing at which it has been foundthat the activation of the second new-version software installed in thesecond electronic control unit 16B will be completed. That is, at such atiming, the activation of the first new-version software installed inthe first electronic control unit 16A may be started.

In this way, in the present embodiment, the installation of the firstnew-version software in the first electronic control unit 16A isperformed while the vehicle 10 is travelling, in the background. Afterthis, the installation of the second new-version software in the secondelectronic control unit 16B is performed while the vehicle 10 isstopped. After the installation of the software in the second electroniccontrol unit 16B has been completed, a process such as described belowis performed. That is, the activation of the first new-version softwareinstalled in the first electronic control unit 16A and the activation ofthe second new-version software installed in the second electroniccontrol unit 16B are performed. According to the present embodiment,since the first new-version software is installed in the firstelectronic control unit 16A while the vehicle 10 is travelling, the timeduring which the user cannot use the vehicle 10 can be shortened.

If the installation of the second new-version software in the secondelectronic control unit 16B has not been completed normally, the updatecontrol section 30 performs a rollback process for the second electroniccontrol unit 16B. Specifically, if the installation of the secondnew-version software in the second electronic control unit 16B has notbeen completed normally, the update control section 30 performs aprocess to return the software of the second electronic control unit 16Bto the state prior to the update. In such a case, the update controlsection 30 does not activate the first new-version software installed inthe first electronic control unit 16A.

If the activation of the second new-version software installed in thesecond electronic control unit 16B has not been completed normally, theupdate control section 30 performs the rollback process for the secondelectronic control unit 16B. Specifically, if the activation of thesecond new-version software installed in the second electronic controlunit 16B has not been completed normally, the update control section 30performs a process to return the software of the second electroniccontrol unit 16B to the state prior to the update. In such a case, theupdate control section 30 does not activate the first new-versionsoftware installed in the first electronic control unit 16A.

The time margin determining section 32 can determine whether there isenough time to perform a retry process for the installation of thenew-version software. The time margin determining section 32 candetermine whether there is enough time to perform the retry processbased on the current timing, the time needed for the retry process, anda scheduled timing at which the vehicle 10 is to be started up. Thescheduled timing at which the vehicle 10 is to be started up can bedetermined by the scheduled startup timing determining section 36. Thatis, the scheduled startup timing of the vehicle 10, can be determined bythe scheduled startup timing determining section 36.

In a case where the installation of the second new-version software inthe second electronic control unit 16B has not been completed normallyand the time margin determining section 32 determines that there isenough time, the update control section 30 performs a process such asdescribed below. Specifically, in such a case, the update controlsection 30 performs the retry process for the installation of the secondnew-version software in the second electronic control unit 16B.

The battery 20 includes a voltage sensor (not shown in the drawings), atemperature sensor (not shown in the drawings), and a current sensor(not shown in the drawings). Signals output respectively from thesesensors included in the battery 20 are supplied to the software updatingapparatus 12. The power amount determining section 34 determines thestate of charge (SOC) of the battery 20, based on the signals suppliedfrom the battery 20. The power amount determining section 34 determineswhether or not the power amount secured in the battery 20 is sufficient.More specifically, the power amount determining section 34 determineswhether or not the power amount secured in the battery 20 is sufficientfor software update. The power amount determining section 34 determineswhether or not the power amount secured in the battery 20 is sufficient,based on the time required for the software update, the power consumedwhen updating the software, and the power amount secured in the battery20. When the power amount determining section 34 determines that thepower amount secured in the battery 20 is sufficient, the update controlsection 30 can start the software update.

If the activation of the first new-version software installed in thefirst electronic control unit 16A has been completed normally, theupdate control section 30 performs a shutdown process on the firstelectronic control unit 16A. If the activation of the second new-versionsoftware installed in the second electronic control unit 16B has beencompleted normally, the update control section 30 performs a shutdownprocess on the second electronic control unit 16B.

The update control section 30 can perform the software update for thefirst electronic control unit 16A such that the first electronic controlunit 16A in which the first new-version software is installed canoperate as described below. The update control section 30 performs thesoftware update such that the first electronic control unit 16A canselectively execute operational logic (source code, program code, orprogram code logic) of the first new-version software and operationallogic of the first old-version software.

As described above, the first old-version software is installed in thefirst bank 50A. In such a state, the first new-version software isinstalled in the second bank 50B. The first new-version software isinstalled in the second bank 50B in the state where the firstold-version software is installed in the first bank 50A, and thereforethe first electronic control unit 16A can operate as described below.Specifically, the first electronic control unit 16A can selectivelyexecute the operational logic of the first old-version software, whichis the software before the update, and the operational logic of thefirst new-version software, which is the software after the update. Thefirst new-version software may be capable of realizing not only theoperational logic of the first new-version software, but also theoperational logic of the first old-version software.

The scheduled startup timing determining section 36 stores informationsuch as shown below in the storage section 26, every time the vehicle 10stops. That is, the scheduled startup timing determining section 36stores information such as shown below in the storage section 26, everytime the main power source of the vehicle 10 is turned OFF. Thescheduled startup timing determining section 36 stores, in the storagesection 26, a date on which the vehicle 10 is stopped, a day of the weekon which the vehicle 10 is stopped, a timing at which the stopping ofthe vehicle 10 is started, a timing at which the stopped vehicle 10 isstarted up, a location where the vehicle 10 is stopped, and the like.The scheduled startup timing determining section 36 determines thescheduled startup timing of the stopped vehicle 10, based on thesepieces of information. The scheduled startup timing determining section36 determines the scheduled startup timing of the vehicle 10 that iscurrently stopped, based on the current position of the vehicle 10, thecurrent timing, and the like, for example. The vehicle 10 includes aGNSS (Global Navigation Satellite System) sensor (not shown in thedrawings), for example. The scheduled startup timing determining section36 can detect the current position of the vehicle 10 based oninformation supplied from the GNSS sensor. For example, in a case wherethe current position of the vehicle 10 is within a site at home and thecurrent timing is 21:00, for example, the scheduled startup timingdetermining section 36 can determine that the vehicle 10 will be startedup at 7:00, for example, on the following morning. The scheduled startuptiming determining section 36 may be realized using artificialintelligence (AI) technology.

If it is predicted that software update will be completed before thescheduled startup timing determined by the scheduled startup timingdetermining section 36, the update control section 30 starts thefollowing process. More specifically, if it is predicted that thesoftware update will be completed by a timing that is a prescribed timebefore the scheduled startup timing determined by the scheduled startuptiming determining section 36, the update control section 30 starts thefollowing process. That is, in such a case, the update control section30 starts installing the second new-version software for the secondelectronic control unit 16B.

A display screen concerning the software update or the like can bedisplayed in the display section 21. The display section 21 is a touchscreen, for example, but is not limited to this. The user can performmanipulation input to the software updating apparatus 12 by manipulatingthe touch screen, for example. As an example, the user can indicate theintent to agree to the software update by manipulating the touch screen.

FIG. 3 is a timing chart illustrating an example of an operation of thesoftware updating apparatus according to the present embodiment.

As shown in FIG. 3 , at a timing t1, the installation of the firstnew-version software is started. At the timing t1, the ignition switch18 is ON and the vehicle 10 is travelling. In this way, the installationof the first new-version software in the first electronic control unit16A is performed in a state where the ignition switch 18 is ON. In otherwords, the installation of the first new-version software in the firstelectronic control unit 16A is performed while the vehicle 10 istravelling. At this time, the installation of the second new-versionsoftware in the second electronic control unit 16B is not performed.

At a timing t2, the ignition switch 18 is turned OFF. In other words,the vehicle 10 is stopped at the timing t2. When the ignition switch 18is turned OFF, the installation of the second new-version software inthe second electronic control unit 16B is started. At this stage, theactivation of the first new-version software installed in the firstelectronic control unit 16A is not performed.

At a timing t3, the installation of the second new-version software inthe second electronic control unit 16B is completed. When theinstallation of the second new-version software in the second electroniccontrol unit 16B is completed, the activation of the second new-versionsoftware installed in the second electronic control unit 16B is started.

When the activation of the second new-version software installed in thesecond electronic control unit 16B is performed, the update controlsection 30 determines whether it is predicted that the activation willbe completed normally. If it is found that the activation will benormally completed, the update control section 30 performs a processsuch as described below. That is, at a timing t4, the update controlsection 30 starts activating the first new-version software installed inthe first electronic control unit 16A. After the activation of thesecond new-version software is started and before it is found that theactivation of the second new-version software will be completednormally, the activation of the first new-version software may bestarted.

At a timing t5, the activation of the second new-version softwareinstalled in the second electronic control unit 16B is completed. Whenthe activation of the second new-version software installed in thesecond electronic control unit 16B is completed normally, the updatecontrol section 30 performs the shutdown process on the secondelectronic control unit 16B.

At a timing t6, the activation of the first new-version softwareinstalled in the first electronic control unit 16A is completed. Whenthe activation of the first new-version software installed in the firstelectronic control unit 16A is completed normally, the update controlsection 30 performs the shutdown process on the first electronic controlunit 16A.

At a timing t7, the ignition switch 18 is turned ON. From the timing t7onward, the first electronic control unit 16A operates based on thefirst new-version software, and the second electronic control unit 16Boperates based on the second new-version software. From the timing t7onward, the first electronic control unit 16A that operates based on thefirst new-version software and the second electronic control unit 16Bthat operates based on the second new-version software, perform acooperative operation (synchronous operation).

FIG. 4 is a flow chart illustrating an example of an operation of thesoftware updating apparatus according to the embodiment.

At step S1, the update control section 30 displays, in the displaysection 21, a display screen for making an inquiry to the user aboutwhether he or she agrees to the software update. Step S1 is performed ina state where the main power source of the vehicle 10 is ON. The usercan indicate the intent with regard to agreeing to the software updateby manipulating the touch screen included in the display section 21, forexample. If the user agrees to the software update (YES at step S1), theprocess moves to step S2. If the user does not agree to the softwareupdate (NO at step S1), the process shown in FIG. 4 is completed.

At step S2, the update control section 30 installs the first new-versionsoftware in the first electronic control unit 16A, in the background.After this, the process moves to step S3.

At step S3, the update control section 30 determines whether the mainpower source of the vehicle 10 is turned OFF. In other words, the updatecontrol section 30 determines whether the ignition switch 18 is turnedOFF. If the main power source of the vehicle 10 is turned OFF (YES atstep S3), the process moves to step S4. If the main power source of thevehicle 10 is ON (NO at step S3), step S3 is repeated.

At step S4, the update control section 30 installs the secondnew-version software in the second electronic control unit 16B. Afterthis, the process moves to step S5.

At step S5, the update control section 30 activates the secondnew-version software installed in the second electronic control unit16B. After this, the process moves to step S6.

At step S6, the update control section 30 activates the firstnew-version software installed in the first electronic control unit 16A.In this way, the process shown in FIG. 4 is completed.

FIG. 5 is a flow chart illustrating an example of an operation of thesoftware updating apparatus according to the present embodiment. Theprocess shown in FIG. 5 can be performed after the process shown in FIG.4 is completed.

At step S11, the update control section 30 determines whether the mainpower source of the vehicle 10 is turned ON. If the main power source ofthe vehicle 10 is turned ON (YES at step S11), the process moves to stepS12. If the main power source of the vehicle 10 is OFF (NO at step S11),step S11 is repeated.

At step S12, the update control section 30 causes the first electroniccontrol unit 16A and the second electronic control unit 16B to startoperating cooperatively. The first electronic control unit 16A executesthe operational logic of the first new-version software, and the secondelectronic control unit 16B executes the operational logic of the secondnew-version software. In this way, the process shown in FIG. 5 iscompleted.

FIG. 6 is a flow chart illustrating an example of an operation of thesoftware updating apparatus according to the present embodiment. Theprocess shown in FIG. 6 can be performed after the software update isperformed.

At step S21, the update control section 30 determines whether thesoftware update has been completed normally. If the software update hasbeen completed normally (YES at step S21), the process shown in FIG. 6is completed. On the other hand, if the software update has not beencompleted normally (NO at step S21), the process moves to step S22.

At step S22, the update control section 30 returns the software to thestate prior to the update. For example, if the software update using thesecond new-version software has not been performed normally in thesecond electronic control unit 16B, the update control section 30returns the software of the second electronic control unit 16B to thestate prior to the update. In this way, the process shown in FIG. 6 iscompleted.

FIG. 7 is a flow chart illustrating an example of an operation of thesoftware updating apparatus according to the present embodiment. Theprocess shown in FIG. 7 can be performed after the software update isperformed.

At step S31, the update control section 30 determines whether thesoftware update has been completed normally. If the software update hasbeen completed normally (YES at step S31), the process shown in FIG. 7is completed. On the other hand, if the software update has not beencompleted normally (NO at step S31), the process moves to step S32.

At step S32, the time margin determining section 32 determines whetherthere is enough time to perform the retry process for the installationof the new-version software. If there is enough time to perform theretry process for the installation of the new-version software (YES atstep S32), the process moves to step S33. If there is not enough time toperform the retry process for the installation of the new-versionsoftware (NO at step S32), the process shown in FIG. 7 is completed.

At step S33, the update control section 30 performs the retry processfor the installation of the new-version software. In this way, theprocess shown in FIG. 7 is completed.

FIG. 8 is a flow chart illustrating an example of an operation of thesoftware updating apparatus according to the present embodiment. Theprocess shown in FIG. 8 can be performed before the software update isperformed.

At step S41, the power amount determining section 34 determines whetheror not the power amount secured in the battery 20 is sufficient. Morespecifically, the power amount determining section 34 determines whetheror not the power amount secured in the battery 20 is sufficient for thesoftware update. If the power amount determining section 34 determinesthat the power amount secured in the battery 20 is sufficient for thesoftware update (YES at step S41), the process moves to step S42. If thepower amount determining section 34 determines that the power amountsecured in the battery 20 is not sufficient for the software update (NOat step S41), the process illustrated in FIG. 8 is completed.

At step S42, the update control section 30 starts updating the software.In this way, the process shown in FIG. 8 is completed.

FIG. 9 is a flowchart showing an example of an operation of the softwareupdating apparatus according to the present embodiment. The processshown in FIG. 9 can be performed after the activation of the firstnew-version software for the first electronic control unit 16A has beencompleted.

At step S51, a determination is made as to whether the activation of thefirst new-version software for the first electronic control unit 16A hasbeen completed normally. If the activation of the first new-versionsoftware for the first electronic control unit 16A has been completednormally (YES at step S51), the process moves to step S52. If theactivation of the first new-version software for the first electroniccontrol unit 16A has not been completed normally (NO at step S51), theprocess shown in FIG. 9 is completed.

At step S52, the update control section 30 performs the shutdown processon the first electronic control unit 16A. In this way, the process shownin FIG. 9 is completed.

FIG. 10 is a flow chart illustrating an example of an operation of thesoftware updating apparatus according to the present embodiment. Theprocess shown in FIG. 10 may be executed after the activation of thesecond electronic control unit 16B is completed.

At step S61, a determination is made as to whether the activation of thesecond new-version software for the second electronic control unit 16Bhas been completed normally. If the activation of the second new-versionsoftware for the second electronic control unit 16B has been completednormally (YES at step S61), the process moves to step S62. If theactivation of the second new-version software for the second electroniccontrol unit 16B has not been completed normally (NO at step S61), theprocess shown in FIG. 10 is completed.

At step S62, the update control section 30 performs the shutdown processon the second electronic control unit 16B. In this way, the processshown in FIG. 10 is completed.

FIG. 11 is a flow chart illustrating an example of an operation of thesoftware updating apparatus according to the present embodiment. Theprocess shown in FIG. 11 can be performed before the installation of thesoftware in the second electronic control unit 16B is started, forexample.

At step S71, the update control section 30 determines whether thesoftware update will be completed by the scheduled startup timing of thevehicle 10. More specifically, the update control section 30 determineswhether the activation of the first new-version software and theactivation of the second new-version software will be completed by atiming that is a prescribed time before the scheduled startup timing ofthe vehicle 10. If it is predicted that the software update will becompleted by the scheduled startup timing of the vehicle 10 (YES at stepS71), the process moves to step S72. If it is predicted that thesoftware update will not be completed by the scheduled startup timing ofthe vehicle 10 (NO at step S71), the process shown in FIG. 11 iscompleted.

At step S72, the update control section 30 starts installing the secondnew-version software in the second electronic control unit 16B. In thisway, the process shown in FIG. 11 is completed.

In this way, in the present embodiment, the installation of the firstnew-version software in the first electronic control unit 16A isperformed while the vehicle 10 is travelling. After this, theinstallation of the second new-version software in the second electroniccontrol unit 16B is performed when the main power source of the vehicle10 is OFF. That is, the second new-version software is installed in thesecond electronic control unit 16B when the ignition switch 18 is OFF.After the installation of the software in the second electronic controlunit 16B has been completed, a process such as described below isperformed. That is, the activation of the first new-version softwareinstalled in the first electronic control unit 16A and the activation ofthe second new-version software installed in the second electroniccontrol unit 16B are performed. According to the present embodiment,since the first new-version software is installed in the firstelectronic control unit 16A while the vehicle 10 is travelling, the timeduring which the user cannot use the vehicle 10 can be shortened. Inthis way, according to the present embodiment, it is possible to updatesoftware more favorably.

Modified Embodiments

While the preferred embodiments of the present invention have beendescribed above, the technical scope of the invention is not limited tothe above described embodiments, and various alterations andimprovements can be made without deviating from the gist of the presentinvention.

For example, in the above-described embodiment, an example is describedof a case where the second electronic control unit 16B does not includea storage-capable region in which the second new-version software can beinstalled in the background was described, but the present invention isnot limited to this. The second electronic control unit 16B may includea storage-capable region in which the second new-version software can beinstalled in the background.

The following is a summary of the embodiments described above.

The software updating apparatus (12) includes: the acquiring section(28) configured to acquire new-version software supplied via the network(25); and the update control section (30) configured to perform asoftware update for each of the plurality of electronic control units(16A, 16B) mounted in the vehicle (10), using the new-version softwareacquired by the acquiring section, wherein the first electronic controlunit (16A) among the plurality of electronic control units includes astorage-capable region in which first new-version software, for updatingfirst old-version software installed in the first electronic controlunit, is allowed to be installed in a background, and wherein the updatecontrol section performs installation of the first new-version softwarein the storage-capable region of the first electronic control unit inthe background before installation of second new-version software in asecond electronic control unit (16B) among the plurality of electroniccontrol units, and after the activation of the second new-versionsoftware installed in the second electronic control unit is started orafter it is found that the activation of the second new-version softwareinstalled in the second electronic control unit will be completednormally, the update control section activates the first new-versionsoftware installed in the storage-capable region of the first electroniccontrol unit. According to such a configuration, the installation of thefirst new-version software in the first electronic control unit isperformed in the background before the installation of the secondnew-version software in the second electronic control unit. Therefore,according to such a configuration, it is possible to shorten the timeduring which the user cannot use the vehicle. In this way, according tosuch a configuration, it is possible to update software more favorably.

The second electronic control unit need not necessarily include astorage-capable region in which the second new-version software isallowed to be installed in the background.

If the installation of the second new-version software in the secondelectronic control unit or the activation of the second new-versionsoftware installed in the second electronic control unit has not beencompleted normally, the update control section performs a rollbackprocess on the second electronic control unit and need not necessarilyactivate the first new-version software installed in the storage-capableregion of the first electronic control unit. According to such aconfiguration, if the installation or activation of the secondnew-version software for the second electronic control unit cannot beperformed normally, it is possible to return the software of the secondelectronic control unit to the state prior to the update.

The update control section may be included in the vehicle.

The software updating apparatus may further include the time margindetermining section (32) configured to determine whether there is enoughtime, wherein if installation of the new-version software in any one ofthe electronic control units has not been completed normally and thetime margin determining section determines that there is enough time,the update control section may perform a retry process for theinstallation of the new-version software in the electronic control unit.According to such a configuration, even if the installation of thenew-version software in the electronic control unit was unable to beperformed normally, it is possible to install the new-version softwarein the electronic control unit by using the retry process.

The software updating apparatus may further include the power amountdetermining section (34) configured to determine whether an amount ofpower secured in the battery (20) that is included in the vehicle issufficient, wherein if the power amount determining section determinesthat the amount of power secured in the battery is sufficient, theupdate control section may start the software update. According to sucha configuration, since the software is not updated when the amount ofelectric power secured in the battery is not sufficient, it is possibleto prevent a problem from occurring.

If the activation of the first new-version software installed in thestorage-capable region of the first electronic control unit has beencompleted normally, the update control section may perform a shutdownprocess on the first electronic control unit, and if the activation ofthe second new-version software installed in the second electroniccontrol unit has been completed normally, the update control section mayperform a shutdown process on the second electronic control unit.According to such a configuration, since the shutdown process isperformed on the electronic control unit when the software update hasbeen completed normally, power saving can be realized.

The update control section may perform the installation of the firstnew-version software in the storage-capable region of the firstelectronic control unit while the vehicle is travelling. According tosuch a configuration, it is possible to reliably shorten the time duringwhich the user cannot use the vehicle.

The first electronic control unit may be an electronic control unit thathas a display control function. The electronic control unit that has adisplay control function includes a high-capacity memory chip.

The first electronic control unit may be an electronic control unit forin-vehicle infotainment. The electronic control unit for in-vehicleinfotainment includes a high-capacity memory chip.

The update control section may perform the software update for the firstelectronic control unit in a manner that, after the software update hasbeen performed, the first electronic control unit is allowed toselectively execute operational logic of the first new-version softwareand operational logic of the first old-version software. According tosuch a configuration, if the first electronic control unit in which thefirst new-version software has been installed and the second electroniccontrol unit in which the second new-version software has been installedcannot operate cooperatively in a favorable manner, it is possible toperform the following. In such a case, the update control sectionreturns the software of the second electronic control unit to the stateprior to the update and causes the first electronic control unit toexecute the operational logic of the first old-version software.Thereby, the first electronic control unit and the second electroniccontrol unit can perform a cooperative operation.

The software updating apparatus may further include the scheduledstartup timing determining section (36) configured to determine ascheduled startup timing, which is a timing at which the vehicle isscheduled to be started up, wherein if the activation of the firstnew-version software is predicted to be completed by the scheduledstartup timing determined by the scheduled startup timing determiningsection, the update control section may start installing the secondnew-version software in the second electronic control unit. According tosuch a configuration, if the software update cannot be completed by thescheduled startup timing of the vehicle, the software update for thesecond electronic control unit is not started. Therefore, it is possibleto prevent the occurrence of a situation where the user cannot use thevehicle.

The update control section may perform the installation of the secondnew-version software in the second electronic control unit when a mainpower source of the vehicle is OFF.

The update control section may perform the activation of the secondnew-version software installed in the second electronic control unit, inparallel with the activation of the first new-version software installedin the first electronic control unit. According to such a configuration,it is possible to shorten the time needed to perform the softwareupdate.

The software updating apparatus includes: the acquiring sectionconfigured to acquire new-version software supplied via the network; andthe update control section configured to perform a software update foreach of the plurality of electronic control units included in thevehicle, using the new-version software acquired by the acquiringsection, wherein the first electronic control unit among the pluralityof electronic control units includes a storage-capable region in whichfirst new-version software, for updating first old-version softwareinstalled in the first electronic control unit, is allowed to beinstalled in a background, wherein the second electronic control unitamong the plurality of electronic control units does not include astorage-capable region in which second new-version software, forupdating second old-version software installed in the second electroniccontrol unit, is allowed to be installed in the background, and whereinwhen a main power source of the vehicle is ON, the update controlsection performs installation of the first new-version software in thestorage-capable region of the first electronic control unit in thebackground, and then, when installation of the first new-versionsoftware in the storage-capable region of the first electronic controlunit has been completed and the main power source of the vehicle isturned OFF, the update control section performs the installation of thesecond new-version software in the second electronic control unit, andthen, after the installation of the second new-version software in thesecond electronic control unit has been completed, the update controlsection activates the first new-version software installed in thestorage-capable region of the first electronic control unit and thesecond new-version software installed in the second electronic controlunit. According to such a configuration, the installation of the firstnew-version software in the first electronic control unit is performedin the background before the installation of the second new-versionsoftware in the second electronic control unit. Therefore, according tosuch a configuration, it is possible to shorten the time during whichthe user cannot use the vehicle.

The vehicle (10) includes the software updating apparatus such asdescribed above.

The software updating method for performing a software update for eachof the plurality of electronic control units included in the vehicle, byusing new-version software supplied via the network, wherein the firstelectronic control unit among the plurality of electronic control unitsincludes a storage-capable region in which first new-version software,for updating first old-version software installed in the firstelectronic control unit, is allowed to be installed in a background,includes: the step (S2) of installing the first new-version software inthe storage-capable region of the first electronic control unit in thebackground; the step (S3, S4) of installing, when the installation ofthe first new-version software in the storage-capable region of thefirst electronic control unit has been completed and a main power sourceof the vehicle is turned OFF, second new-version software in a secondelectronic control unit among the plurality of electronic control units;and the step (S5, S6) of activating, after activation of the secondnew-version software installed in the second electronic control unit isstarted or after it is found that the activation of the secondnew-version software installed in the second electronic control unitwill be completed normally, the first new-version software installed inthe storage-capable region of the first electronic control unit.

REFERENCE SIGNS LIST

-   10: vehicle-   11: software updating system-   12: software updating apparatus-   14, 40: communicating section-   16A, 16B: electronic control unit-   18: ignition switch-   20: battery-   21: display section-   22: server-   24: computing section-   25: network-   26: storage section-   28: acquiring section-   30: update control section-   32: time margin determining section-   34: power amount determining section-   36: scheduled startup timing determining section-   38: database

The invention claimed is:
 1. A software updating apparatus comprising acentral processing unit including: an acquiring section configured toacquire new-version software supplied via a network; and an updatecontrol section configured to perform a software update for each offirst and second electronic control units mounted in a vehicle, usingthe new-version software acquired by the acquiring section, wherein thefirst electronic control unit operated by first old-version softwareincludes a storage-capable region in which first new-version software isallowed to be installed in a background, wherein the second electroniccontrol unit operated by second old-version software does not includethe storage-capable region in which second new-version software isallowed to be installed in the background, and wherein the updatecontrol section performs installation of the first new-version softwarein the storage-capable region in the first electronic control unit inthe background before the installation of the second new-versionsoftware in the second electronic control unit, and the update controlsection activates the first new-version software installed in thestorage-capable region of the first electronic control unit afteractivation of the second new-version software installed in the secondelectronic control unit is started or after having determined that theactivation of the second new-version software installed in the secondelectronic control unit will be completed normally.
 2. The softwareupdating apparatus according to claim 1, wherein if the installation ofthe second new-version software in the second electronic control unit orthe activation of the second new-version software installed in thesecond electronic control unit has not been completed normally, theupdate control section performs a rollback process on the secondelectronic control unit and does not activate the first new-versionsoftware installed in the storage-capable region of the first electroniccontrol unit.
 3. The software updating apparatus according to claim 1,wherein the update control section is included in the vehicle.
 4. Thesoftware updating apparatus according to claim 1, further comprising atime margin determining section configured to determine whether there isenough time, wherein if installation of the second new-version softwarein the second electronic control unit has not been completed normallyand the time margin determining section determines that there is enoughtime, the update control section performs a retry process for theinstallation of the second new-version software in the second electroniccontrol unit.
 5. The software updating apparatus according to claim 1,wherein the central processing unit further includes a power amountdetermining section configured to determine whether an amount of powersecured in a battery that is included in the vehicle is sufficient,wherein if the power amount determining section determines that theamount of power secured in the battery is sufficient, the update controlsection starts the software update.
 6. The software updating apparatusaccording to claim 1, wherein if the activation of the first new-versionsoftware installed in the storage-capable region of the first electroniccontrol unit has been completed normally, the update control sectionperforms a shutdown process on the first electronic control unit, and ifthe activation of the second new-version software installed in thesecond electronic control unit has been completed normally, the updatecontrol section performs a shutdown process on the second electroniccontrol unit.
 7. The software updating apparatus according to claim 1,wherein the update control section performs the installation of thefirst new-version software in the storage-capable region of the firstelectronic control unit while the vehicle is travelling.
 8. The softwareupdating apparatus according to claim 1, wherein the first electroniccontrol unit is an electronic control unit that has a display controlfunction.
 9. The software updating apparatus according to claim 8,wherein the electronic control unit that has the display controlfunction is an electronic control unit for in-vehicle infotainment. 10.The software updating apparatus according to claim 1, wherein the updatecontrol section performs the software update for the first electroniccontrol unit in a manner that, after the software update has beenperformed, the first electronic control unit is allowed to selectivelyexecute operational logic of the first new-version software andoperational logic of the first old-version software.
 11. The softwareupdating apparatus according to claim 1, further comprising a scheduledstartup timing determining section configured to determine a scheduledstartup timing, which is a timing at which the vehicle is scheduled tobe started up, wherein if the activation of the first new-versionsoftware is predicted to be completed by the scheduled startup timingdetermined by the scheduled startup timing determining section, theupdate control section starts installing the second new-version softwarein the second electronic control unit.
 12. The software updatingapparatus according to claim 1, wherein the update control sectionperforms the installation of the second new-version software in thesecond electronic control unit when a main power source of the vehicleis OFF.
 13. The software updating apparatus according to claim 1,wherein the update control section performs the activation of the secondnew-version software installed in the second electronic control unit, inparallel with the activation of the first new-version software installedin the first electronic control unit.
 14. A software updating apparatuscomprising a central processing unit including: an acquiring sectionconfigured to acquire new-version software supplied via a network; andan update control section configured to perform a software update foreach of first and second electronic control units included in a vehicle,using the new-version software acquired by the acquiring section,wherein the first electronic control unit operated by first old-versionsoftware includes a storage-capable region in which first new-versionsoftware is allowed to be installed in a background, wherein the secondelectronic control unit operated by second old-version software does notinclude the storage-capable region in which second new-version software,for updating the second old-version software installed in the secondelectronic control unit, is allowed to be installed in the background,and wherein when a main power source of the vehicle is ON, the updatecontrol section performs installation of the first new-version softwarein the storage-capable region in the first electronic control unit inthe background before the installation of the second new-versionsoftware in the second electronic control unit, and when the main powersource of the vehicle is turned OFF, the update control section performsinstallation of the second new-version software in the second electroniccontrol unit, and then, the update control section activates the firstnew-version software installed in the storage-capable region of thefirst electronic control unit after activation of the second new-versionsoftware installed in the second electronic control unit is started orafter having determined that the activation of the second new-versionsoftware installed in the second electronic control unit will becompleted normally.
 15. A vehicle comprising a software updatingapparatus comprising a central processing unit including: an acquiringsection configured to acquire new-version software supplied via anetwork; and an update control section configured to perform a softwareupdate for each of first and second electronic control units mounted inthe vehicle, using the new-version software acquired by the acquiringsection, wherein the first electronic control unit operated by firstold-version software includes a storage-capable region in which firstnew-version software is allowed to be installed in a background, whereinthe second electronic control unit operated by second old-versionsoftware does not include the storage-capable region in which secondnew-version software is allowed to be installed in the background, andwherein the update control section performs installation of the firstnew-version software in the storage-capable region of the firstelectronic control unit in the background before installation of thesecond new-version software in the second electronic control unit, andthe update control section activates the first new-version softwareinstalled in the storage-capable region of the first electronic controlunit after activation of the second new-version software installed inthe second electronic control unit is started or after having determinedthat the activation of the second new-version software installed in thesecond electronic control unit will be completed normally.
 16. Asoftware updating method for performing a software update for each offirst and second electronic control units included in a vehicle, byusing new-version software supplied via a network, wherein the firstelectronic control unit operated by first old-version software includesa storage-capable region in which first new-version software is allowedto be installed in a background, wherein the second electronic controlunit operated by second old-version software does not include thestorage-capable region in which second new-version software is allowedto be installed in the background, the method comprising: a step ofinstalling the first new-version software in the storage-capable regionof the first electronic control unit in the background; a step ofinstalling, when the installation of the first new-version software inthe storage-capable region of the first electronic control unit has beencompleted and a main power source of the vehicle is turned OFF, thesecond new-version software in the second electronic control unit; and astep of activating, the first new-version software installed in thestorage-capable region of the first electronic control unit afteractivation of the second new-version software installed in the secondelectronic control unit is started or after having determined that theactivation of the second new-version software installed in the secondelectronic control unit will be completed normally.